Ubuntu alert USN-8862-1 (libxpm)

From:
             
 
noreply+usn-bot--- via ubuntu-security-announce <ubuntu-security-announce@lists.ubuntu.com>
To:
             
 
ubuntu-security-announce@lists.ubuntu.com
Subject:
             
 
[USN-8862-1] libXpm vulnerability
Date:
             
 
Thu, 01 Oct 2026 13:55:41 +0000
Message-ID:
             
 
<E1xCHG9-00070X-R0@lists.ubuntu.com>
Cc:
             
 
noreply+usn-bot@canonical.com
==========================================================================
Ubuntu Security Notice USN-8862-1
October 01, 2026

libxpm vulnerability
==========================================================================

A security issue affects these releases of Ubuntu and its derivatives:

- Ubuntu 26.04 LTS
- Ubuntu 24.04 LTS
- Ubuntu 22.04 LTS

Summary:

libXpm could be made to crash if it opened a specially crafted file.

Software Description:
- libxpm: X11 pixmap library

Details:

It was discovered that libXpm did not correctly handle XPM images with
zero-dimension values. A local attacker could possibly use this issue to
cause libXpm to use excessive resources, leading to a denial of service.

Update instructions:

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 26.04 LTS
  libxpm4                         1:3.5.17-1ubuntu0.26.04.2
  xpmutils                        1:3.5.17-1ubuntu0.26.04.2

Ubuntu 24.04 LTS
  libxpm4                         1:3.5.17-1ubuntu0.24.04.2
  xpmutils                        1:3.5.17-1ubuntu0.24.04.2

Ubuntu 22.04 LTS
  libxpm4                         1:3.5.12-1ubuntu0.22.04.4
  xpmutils                        1:3.5.12-1ubuntu0.22.04.4

In general, a standard system update will make all the necessary changes.

References:
  https://ubuntu.com/security/notices/USN-8862-1
  CVE-2026-94287

Package Information:
  https://launchpad.net/ubuntu/+source/libxpm/1:3.5.17-1ubu...
  https://launchpad.net/ubuntu/+source/libxpm/1:3.5.17-1ubu...
  https://launchpad.net/ubuntu/+source/libxpm/1:3.5.12-1ubu...


Attachment: signature.asc (type=application/pgp-signature)
-----BEGIN PGP SIGNATURE-----

iQIzBAABCgAdFiEE+8neBLO2Hp/ppPlOcpJm3tlzhgEFAmq+ZSwACgkQcpJm3tlz
hgE1zw//c6iyj0IaTGP+fXfk8ESxuFVotUC3VpWE8wmGX9iOEAT9cTm4fz8YHUTx
Cbc+B2WkwkiuVap4KmKvGWXLRhUliMvcc5x5OpIfgza/jlDUsFZxlBF9qG85oiXy
EyKjV5ZAaOScgCtPUbfhlg0rC0PPwVuaROMAYbWMCW5A+OZo9E4/2fEhhbA5vm/p
EqLdUNIPdOjhUyPkRh+K2LCIsG3dC7yevVxUAAY952GnscbZYTAYBEhKWyNa9RjI
zu9IKJkhp05BZcyComWcag4I71IJIG6bkKSDEEkOpS2SAl7yWCDkJWP00GiQLK3E
KnXG3VvJCz2IFXr5r/gEGtEQQ1mGpupDVfmeX1AwmOHOhhjwzYqCmt4pQoZzwCAf
OtK/F+K9gjR4KVEJjRhLh88hno7KP5KYP2NmVMPdAW3Np7wYxUS2srdkoKnZtFhh
EGtIPHZNqnjeATptrY2k1+oZXJyrc6ieDRQq5HrNhsfWUfmGUkk0R8h86Wrt1GMr
/OymnwSgaSoZ8u/KCkPyjOR43D/L46fat4N0KbTF5jep0W7m1r0Xd1aPatloIIGr
qgwdMFXj6QkTBgzaFSGKWcNtWaMPXjirOKskp4/euun7pge7ugl06hIAXnQW7Rif
LPhSWMEq7jLXibNG8RPxcz6W5EC1lS4lv43mtmoR1oXSRxV+dvE=
=5NrZ
-----END PGP SIGNATURE-----